Information about a vulnerability (CVE-2026-64561) in the KVM hypervisor has been revealed, allowing root access to the host environment if root access is gained in the guest system. This issue can also be utilized for local privilege escalation when there is access to the device /dev/kvm (for instance, in RHEL this access is granted to all users). A prototype exploit is available for download. The issue has been assigned the codename Zapscape.
The vulnerability is caused by a use-after-free memory access in the hypervisor components KVM, executed on the virtual machine side for emulating memory management unit (MMU) control and translating addresses between the host and guest systems. The vulnerability manifests on systems with Intel and AMD processors during recursive deletion of shadow memory pages, which occurs when freeing MMU memory (KVM recursively removes the root shadow page that continues to be used during MMU cleanup).
The problem is due to an error made 6 years ago, which was fixed a few days ago in kernel updates 7.1.6, 6.18.42, and 6.6.148. The status of vulnerability fixes in distributions can be evaluated on the following pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, Fedora.
KĂ€lla: opennet.ru
